Erich Titl wanted us to know:
>Nice, we could actually build a wrapper around freshclam to only fetch when
>there is a new version ready.
It already does this.
<snip>
12:39:51.553344 IP 10.1.1.240.41996 > 65.77.42.207.80: P 1:145(144) ack 1 win 5840
<nop,nop,timestamp 191254661 149266201>
0x0000: 4500 00c4 1b41 4000 4006 a6e6 0a01 01f0 [EMAIL PROTECTED]@.......
0x0010: 414d 2acf a40c 0050 0c61 4b7d 9e51 df57 AM*....P.aK}.Q.W
0x0020: 8018 16d0 79c0 0000 0101 080a 0b66 5085 ....y........fP.
0x0030: 08e5 9f19 4745 5420 2f6d 6169 6e2e 6376 ....GET./main.cv
0x0040: 6420 4854 5450 2f31 2e31 0d0a 486f 7374 d.HTTP/1.1..Host
0x0050: 3a20 6461 7461 6261 7365 2e63 6c61 6d61 :.database.clama
0x0060: 762e 6e65 740d 0a55 7365 722d 4167 656e v.net..User-Agen
0x0070: 743a 2063 6c61 6d61 762f 302e 3735 2e31 t:.clamav/0.75.1
0x0080: 0d0a 4361 6368 652d 436f 6e74 726f 6c3a ..Cache-Control:
0x0090: 206e 6f2d 6361 6368 650d 0a43 6f6e 6e65 .no-cache..Conne
0x00a0: 6374 696f 6e3a 2063 6c6f 7365 0d0a 5261 ction:.close..Ra
0x00b0: 6e67 653a 2062 7974 6573 3d30 2d35 3131 nge:.bytes=0-511
0x00c0: 0d0a 0d0a ....
<snip>
12:39:51.690287 IP 10.1.1.240.41997 > 65.77.42.207.80: P 1:146(145) ack 1 win 5840
<nop,nop,timestamp 191254798 149266215>
0x0000: 4500 00c5 f890 4000 4006 c995 0a01 01f0 [EMAIL PROTECTED]@.......
0x0010: 414d 2acf a40d 0050 0d14 a843 8cb0 0e1e AM*....P...C....
0x0020: 8018 16d0 d840 0000 0101 080a 0b66 510e [EMAIL PROTECTED]
0x0030: 08e5 9f27 4745 5420 2f64 6169 6c79 2e63 ...'GET./daily.c
0x0040: 7664 2048 5454 502f 312e 310d 0a48 6f73 vd.HTTP/1.1..Hos
0x0050: 743a 2064 6174 6162 6173 652e 636c 616d t:.database.clam
0x0060: 6176 2e6e 6574 0d0a 5573 6572 2d41 6765 av.net..User-Age
0x0070: 6e74 3a20 636c 616d 6176 2f30 2e37 352e nt:.clamav/0.75.
0x0080: 310d 0a43 6163 6865 2d43 6f6e 7472 6f6c 1..Cache-Control
0x0090: 3a20 6e6f 2d63 6163 6865 0d0a 436f 6e6e :.no-cache..Conn
0x00a0: 6563 7469 6f6e 3a20 636c 6f73 650d 0a52 ection:.close..R
0x00b0: 616e 6765 3a20 6279 7465 733d 302d 3531 ange:.bytes=0-51
0x00c0: 310d 0a0d 0a 1....
<snip>
It only retrives the first 512 bytes of data from each CVD file. Here
is what a sample return packet looks like:
12:39:51.761643 IP 65.77.42.207.80 > 10.1.1.240.41997: P 1:812(811) ack 146 win 57456
<nop,nop,timestamp 149266222 191254798>
0x0000: 4500 035f d641 4000 3506 f44a 414d 2acf [EMAIL PROTECTED]
0x0010: 0a01 01f0 0050 a40d 8cb0 0e1e 0d14 a8d4 .....P..........
0x0020: 8018 e070 66da 0000 0101 080a 08e5 9f2e ...pf...........
0x0030: 0b66 510e 4854 5450 2f31 2e31 2032 3036 .fQ.HTTP/1.1.206
0x0040: 2050 6172 7469 616c 2043 6f6e 7465 6e74 .Partial.Content
0x0050: 0d0a 4461 7465 3a20 4672 692c 2031 3320 ..Date:.Fri,.13.
0x0060: 4175 6720 3230 3034 2032 303a 3035 3a30 Aug.2004.20:05:0
0x0070: 3220 474d 540d 0a53 6572 7665 723a 2041 2.GMT..Server:.A
0x0080: 7061 6368 652f 312e 332e 3237 2028 556e pache/1.3.27.(Un
0x0090: 6978 290d 0a4c 6173 742d 4d6f 6469 6669 ix)..Last-Modifi
0x00a0: 6564 3a20 4672 692c 2031 3320 4175 6720 ed:.Fri,.13.Aug.
0x00b0: 3230 3034 2031 383a 3535 3a32 3720 474d 2004.18:55:27.GM
0x00c0: 540d 0a45 5461 673a 2022 3232 3265 3232 T..ETag:."222e22
0x00d0: 2d32 3761 6538 2d34 3131 6430 6539 6622 -27ae8-411d0e9f"
0x00e0: 0d0a 4163 6365 7074 2d52 616e 6765 733a ..Accept-Ranges:
0x00f0: 2062 7974 6573 0d0a 436f 6e74 656e 742d .bytes..Content-
0x0100: 4c65 6e67 7468 3a20 3531 320d 0a43 6f6e Length:.512..Con
0x0110: 7465 6e74 2d52 616e 6765 3a20 6279 7465 tent-Range:.byte
0x0120: 7320 302d 3531 312f 3136 3235 3336 0d0a s.0-511/162536..
0x0130: 436f 6e6e 6563 7469 6f6e 3a20 636c 6f73 Connection:.clos
0x0140: 650d 0a43 6f6e 7465 6e74 2d54 7970 653a e..Content-Type:
0x0150: 2074 6578 742f 706c 6169 6e0d 0a0d 0a43 .text/plain....C
0x0160: 6c61 6d41 562d 5644 423a 3133 2041 7567 lamAV-VDB:13.Aug
0x0170: 2032 3030 3420 3230 2d35 3520 2b30 3230 .2004.20-55.+020
0x0180: 303a 3435 323a 3136 3138 3a32 3a31 3362 0:452:1618:2:13b
0x0190: 3836 3834 3366 3661 6232 6564 3761 6131 86843f6ab2ed7aa1
0x01a0: 3536 3436 3531 6531 3030 3833 373a 4d38 564651e100837:M8
0x01b0: 6d45 4938 6f76 7063 794b 3345 5744 7670 mEI8ovpcyK3EWDvp
0x01c0: 556f 7439 446e 3139 657a 3879 624a 4935 Uot9Dn19ez8ybJI5
0x01d0: 3935 6f36 7536 5733 6f75 4d41 786b 4859 95o6u6W3ouMAxkHY
0x01e0: 6a34 4868 4b6a 4252 2f70 5742 7442 4743 j4HhKjBR/pWBtBGC
0x01f0: 3465 4e64 6874 4644 2b48 644a 7a74 694f 4eNdhtFD+HdJztiO
0x0200: 557a 4c32 4943 5057 4a41 4943 494a 6850 UzL2ICPWJAICIJhP
0x0210: 777a 4939 5763 5966 7735 426c 684f 3957 wzI9WcYfw5BlhO9W
0x0220: 4639 6636 4b6c 6d70 6452 6262 5654 354f F9f6KlmpdRbbVT5O
0x0230: 2f6e 6175 7239 4b36 694f 4d61 3132 4b73 /naur9K6iOMa12Ks
0x0240: 4f66 7554 6464 3039 5a38 6265 5045 364d OfuTdd09Z8bePE6M
0x0250: 314c 6350 3464 4a4d 6a3a 746f 6d65 6b20 1LcP4dJMj:tomek.
0x0260: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0270: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0280: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0290: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02a0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02b0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02c0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02d0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02e0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x02f0: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0300: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0310: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0320: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0330: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0340: 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0350: 2020 2020 2020 2020 2020 2020 2020 20 ...............
So it does not download each file in its entirety as people have been
suggesting.
--
Regards... Todd
We should not be building surveillance technology into standards.
Law enforcement was not supposed to be easy. Where it is easy,
it's called a police state. -- Jeff Schiller on NANOG
Linux kernel 2.6.3-15mdkenterprise 2 users, load average: 0.00, 0.02, 0.00
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
